Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Camshaft007
New Contributor

Fortigate-60e v5.6.3 Custom NTP server issue

All,

I'm currently attempting to make my FGT the singe source of truth for all my internal networks as the NTP server which is working fine.  However, I want my my FGT to update to a custom external NTP server instead of Using Fortiguard as my source for time.  After digging for a few hours, I've come to the conclusion that there is either a bug in the code or a limitation on the device which does not support custom NTP server configuration(s).  I find this not cool at all and I'm hoping that perhaps I'm missing something here.  Below is what I've tried..

[size="1"]FGT60E (ntp) # sh full[/size] [size="1"]config system ntp[/size] [size="1"]  set ntpsync enable[/size] [size="1"]  set type fortiguard[/size] [size="1"]  set syncinterval 60[/size] [size="1"]  set source-ip 10.10.10.254[/size] [size="1"]  set server-mode enable[/size] [size="1"]  set interface "internal1" "internal2" "internal3" "internal4" "internal5" "internal6"[/size] [size="1"]end[/size]

[size="1"]FGT60E (ntp) # set type custom[/size]

[size="1"]FGT60E (ntp) # end[/size] [size="1"]There isn't any ntpserver ![/size] [size="1"]object set operator error, -651 discard the setting[/size] [size="1"]Command fail. Return code -651[/size]

 

[size="1"]FGT60E # config system ntp[/size]

[size="1"]FGT60E (ntp) # set type custom[/size]

[size="1"]FGT60E (ntp) # set ?[/size] [size="1"]  ntpsync Enable/disable setting the FortiGate system time by synchronizing with an NTP Server.[/size] [size="1"]  type Use the FortiGuard NTP server or any other available NTP Server.[/size] [size="1"]  syncinterval NTP synchronization interval (1 - 1440 min).[/size] [size="1"]  source-ip Source IP for communications to the NTP server.[/size] [size="1"]  server-mode Enable/disable FortiGate NTP Server Mode. Your FortiGate becomes an NTP server for other devices on your network. The FortiGate relays NTP requests to its configured NTP server.[/size] [size="1"]  interface FortiGate interface(s) with NTP server mode enabled. Devices on your network can contact these interfaces for NTP services.[/size]

 

[size="1"]FGT60E (ntp) # unset source-ip[/size]

[size="1"]FGT60E (ntp) # end[/size] [size="1"]There isn't any ntpserver ![/size] [size="1"]object set operator error, -651 discard the setting[/size] [size="1"]Command fail. Return code -651[/size]

 

[size="1"]FGT60E # diagnose debug config-error-log read[/size]

 

Any help from the community is much appreciated.

" The Linux philosophy is ' Laugh in the face of danger' . Oops. Wrong One. ' Do it yourself' . Yes, that' s it." - Linus Torvalds

" The Linux philosophy is ' Laugh in the face of danger' . Oops. Wrong One. ' Do it yourself' . Yes, that' s it." - Linus Torvalds
3 REPLIES 3
ede_pfau
SuperUser
SuperUser

hi,

 

you need to continue like this:

config ntpserver

   edit 1

      set server 192.53.103.104 (for example)

   next

end

Sometimes there is a subsection opening with "config ..." and ending with "end", like in this case.

And no, there's no video for this, it's all documented in the CLI Reference :)

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Camshaft007

Oh man ede_pfau, you're my freggin hero!  This was so annoying.. And your right, it's mentioned in the CLI guide.. I didn't know the 5.6.3 guide was available, i should have gone there first.

 

FGT60E (ntp) # sh full
config system ntp
    set ntpsync enable
    set type custom
    set syncinterval 60
    config ntpserver
        edit 1
            set server "time.nist.gov"
            set ntpv3 disable
        next
    end
    set source-ip 0.0.0.0
    set server-mode enable
    set interface "internal1" "internal2" "internal3" "internal4" "internal5" "internal6"
end

 

" The Linux philosophy is ' Laugh in the face of danger' . Oops. Wrong One. ' Do it yourself' . Yes, that' s it." - Linus Torvalds

" The Linux philosophy is ' Laugh in the face of danger' . Oops. Wrong One. ' Do it yourself' . Yes, that' s it." - Linus Torvalds
ede_pfau

uh-oh, I looked it up in the 4.3 guide from 2012...

just kiddin'

 

and thanks for your hint to all of us to use the "show full" after setting 'set type custom'. Often quicker than a lookup.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors